Mac address legitimacy verification method and communication device

Abstract

The present application relates to the technical field of communications, and discloses a MAC address legitimacy verification method and a communication device. The method comprises: receiving a session establishment request message initiated by a user terminal, and sending verification indication information to the user terminal; and when it is determined that the MAC address verification information corresponding to the verification indication information and sent by the user terminal is matched with the verification indication information, determining that a MAC address corresponding to the user terminal is a legitimate MAC address.

Description

MAC address validity verification method and communication equipment

[0001] Cross-references

[0002] This application claims priority to a Chinese patent application filed with the Patent Office of China on June 28, 2023, with application number 202310782472.6 and titled “MAC address legitimacy verification method and communication device.” The entire contents of that application are incorporated by reference into this application. Technical Field

[0003] The embodiments of the present application relate to the field of communication technology, and in particular to a MAC address validity verification method and communication device. Background Art

[0004] A MAC (Media Access Control) address, also known as a physical address or hardware address, is used to define the location of network devices. With the advancement of network technology, more and more user terminals, such as mobile phones, smart terminals, and multimedia devices, have network capabilities. These terminals typically use MAC addresses to identify themselves. During network transmission, communication devices use MAC addresses to identify the location of user terminals.

[0005] When a user terminal accesses a communication network, the communication device needs to learn the MAC address of the user terminal and forward data packets. However, MAC addresses can be easily forged by malicious users, causing the communication device or user terminal to be attacked, affecting the security of the communication network.

[0006] Summary of the Invention

[0007] The embodiments of the present application provide a MAC address validity verification method and a communication device to at least solve the problem in the prior art that the validity of the MAC address cannot be verified and the communication network security is low.

[0008] In order to solve the above technical problems, this application is implemented as follows:

[0009] In the first aspect, an embodiment of the present application provides a method for verifying the legitimacy of a MAC address, the method comprising: receiving a session establishment request message initiated by a user terminal, sending verification indication information to the user terminal, the verification indication information being used to indicate a legitimacy verification of the MAC address of the user terminal; and determining that the MAC address corresponding to the verification indication information sent by the user terminal matches the verification indication information, determining that the MAC address corresponding to the user terminal is a legal MAC address.

[0010] In a second aspect, an embodiment of the present application provides a communication device comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps of the method described in the first or second aspect above are implemented.

[0011] In a third aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect above are implemented.

[0012] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0014] FIG1 shows a schematic diagram of the system architecture of a 5G network;

[0015] FIG2 is a schematic diagram showing a process of a user terminal accessing a 5G network;

[0016] FIG3 shows a schematic flow chart of a MAC address validity verification method provided in an embodiment of the present application;

[0017] FIG4 shows a flow chart of a method for verifying the legitimacy of a MAC address when a user terminal accesses a 5G network according to an embodiment of the present application;

[0018] FIG5 shows a second flow chart of a method for verifying the legitimacy of a MAC address when a user terminal according to an embodiment of the present application accesses a 5G network;

[0019] FIG6 shows a third flow chart of a method for verifying the legitimacy of a MAC address when a user terminal accesses a 5G network according to an embodiment of the present application;

[0020] FIG7 shows a fourth flow chart of a method for verifying the legitimacy of a MAC address when a user terminal accesses a 5G network according to an embodiment of the present application;

[0021] FIG8 shows a schematic structural diagram of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0022] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0023] Figure 1 shows a schematic diagram of the system architecture of a 5G network. As shown in the figure, the network element function entities (NFs) related to the Session Management Function (SMF) include: Access and Mobility Management Function (AMF), Unified Data Management (UDM), Policy Control Function (PCF), and User Plane Function (UPF). As shown in Figure 2, when a user terminal accesses a 5G network, its message interaction process can be divided into the user normal access phase, the MAC learning and data packet forwarding phase, in which,

[0024] The normal user access phase may include the following steps:

[0025] Step 11: The User Equipment (UE) sends a PDU session establishment request message PDUSession_CreateSMContext Request to the SMF to establish a PDU (Protocol Data Unit) session;

[0026] Step 12: SMF sends a Nudm_SDM_Get request to UDM to request slice selection subscription data;

[0027] Step 13: UDM sends Nudm_SDM_Get response to SMF;

[0028] Step 14: SMF sends a PDU session establishment response message PDUSession_CreateSMContext Response to the user terminal UE;

[0029] Step 15: SMF sends a PFCP (Packet Forwarding Control Protocol) session establishment request message PFCP Session Establishment Request to UPF;

[0030] Step 16: UPF sends a PFCP session establishment response message PFCP Session Establishment Response to SMF;

[0031] Step 17: The UE sends a PDU session resource update request message Nsmf_PDUSession_UpdateSMContext Request to the SMF;

[0032] Step 18: SMF sends a PFCP Session Modification Request message to UDM;

[0033] Step 19: UDM sends a PFCP session update response message PFCP Session Modification Request to SMF;

[0034] Step 20: SMF sends a PFCP session modification response message Nsmf_PDUSession_UpdateSMContext Response to the UE.

[0035] The MAC learning and data packet forwarding phase includes the following stages:

[0036] Step 31: The UE sends a data message to the UPF;

[0037] Step 32: The UPF sends a PFCP session report request message PFCP Session Report Reques (carrying the MAC address of the user terminal) to the SMF;

[0038] Step 35: SMF sends a PFCP Session Report Response message to UPF;

[0039] Step 36: SMF sends a PFCP Session Modification Request message to UPF;

[0040] Step 37: UPF sends a PFCP Session Modification Response message to SMF;

[0041] Subsequently, the data packets corresponding to the MAC address are allowed to pass.

[0042] From the above message exchange process for a user terminal accessing a 5G network, it can be seen that when a user terminal accesses the communication network, the communication device cannot determine the legitimacy of the user terminal's MAC address. Regardless of whether the user terminal's MAC address is legitimate, MAC learning and data message forwarding will be performed. This puts the communication device or user terminal at risk of attack, affecting the security of the communication network. In addition, the capacity of the MAC address table is limited. When a large number of data messages corresponding to illegal MAC addresses are sent to the communication device, the MAC address table resources on the communication device may be exhausted, resulting in a waste of network resources.

[0043] Based on this, an embodiment of the present application provides a MAC address legitimacy verification method for solving the problem that the communication device cannot verify the legitimacy of the MAC address of the user terminal.

[0044] Figure 3 shows a flow chart of a MAC address legitimacy verification method provided by an embodiment of the present application. The method can be applied to the UDM network element function entity in the above-mentioned 5G network, and can also be applied to communication equipment. In the embodiment of the present application, the execution subject is an UDM network element function entity in a 5G network as an example. As shown in the figure, the method 300 may include the following steps:

[0045] S301: Receive a session establishment request message initiated by a user terminal, and send verification indication information to the user terminal.

[0046] S302: When it is determined that the MAC address verification information corresponding to the verification indication information sent by the user terminal matches the verification indication information, determine that the MAC address corresponding to the user terminal is a legal MAC address.

[0047] The verification instruction information is used to instruct to perform a validity check on the MAC address of the user terminal.

[0048] Through the above steps, when a user terminal accesses the communication network, a session establishment request message initiated by the user terminal is received, and verification indication information is sent to the user terminal. Furthermore, the legitimacy of the MAC address corresponding to the user terminal is determined based on the MAC address verification information and the verification indication information sent by the user terminal. This allows for verification of the validity of the user terminal's MAC address, preventing illegal MAC addresses from accessing the network, reducing the risk of attacks on communication devices or user terminals, and thereby improving the security of the communication network.

[0049] In one possible implementation, the verification indication information includes a first verification value, where the first verification value is a verification value obtained by encrypting a first random number using a public key; the MAC address verification information includes a second verification value, where the second verification value is a verification value obtained by encrypting first communication information using a private key; and the first communication information includes the MAC address of the user terminal and the first random number.

[0050] Determining in step S302 that the MAC address verification information corresponding to the verification indication information sent by the user terminal matches the verification indication information includes:

[0051] In a case where it is determined that the first verification value and the second verification value satisfy a first verification condition, it is determined that the MAC address verification information matches the verification indication information.

[0052] In a specific implementation, UDM can download a digital certificate and obtain a public key from a CA (Certificate Authority) certification center; the user terminal can obtain the private key in the digital certificate through a secure method approved by the CA certification center. UDM first generates a random number, encrypts the random number with a public key, and uses the encrypted result as a first verification value; UDM sends the first verification value to the user terminal, and the user terminal uses the private key to decode the first verification value to obtain the random number generated by UMD. Here, only legitimate user terminals have private keys, and illegal terminals cannot decrypt and obtain the correct random number without private keys. Then, the user terminal encrypts the random number generated by UMD and the MAC address to obtain a second verification value, and sends it to UDM. When UDM determines that the first verification value and the second verification value meet the first verification condition, it determines that the MAC address verification information matches the verification indication information.

[0053] Determining that the first verification value and the second verification value meet a first verification condition includes:

[0054] Determine a first hash value based on the MAC address of the user terminal and a first random number;

[0055] Decrypting the second check value using the public key to obtain a second hash value;

[0056] If the first hash value is equal to the second hash value, it is determined that the first verification value and the second verification value meet a first verification condition.

[0057] Furthermore, after determining that the MAC address of the user terminal is a valid MAC address, the method further includes:

[0058] Determine a routing forwarding rule corresponding to the MAC address according to the user terminal; and forward the data message sent by the user terminal according to the routing forwarding rule.

[0059] As shown in Figure 4, when a user terminal accesses a 5G network, the MAC address validity verification method may include the following steps:

[0060] Step 11: The UE sends a PDUSession_CreateSMContext Request message to the SMF to request the establishment of a PDU session;

[0061] Step 12: SMF sends a Nudm_SDM_Get request to UDM to request slice selection subscription data;

[0062] Step 13: The UDM sends a Nudm_SDM_Get Response to the SMF, indicating that the MAC address needs to be verified for validity and carrying a verification value A. The verification value A can be generated in the following way: The UDM first generates a 16-byte (128-bit) random number, encrypts the random number with the public key in the digital certificate, and uses the encrypted result as the verification value A. The verification indication information can be as shown in Table 1:

[0063] Table 1

[0064] Step 14: The PDUSession_CreateSMContext Response indicates that the MAC needs to be verified for validity and carries the verification value A;

[0065] Step 15: SMF sends PFCP Session Establishment Request to UFP;

[0066] Step 16: UPF sends PFCP Session Establishment Response to SMF;

[0067] Step 17: The UE sends an Nsmf_PDUSession_UpdateSMContext Request to the SMF, carrying its own check value B and MAC address. Specifically, the check value B can be generated in the following manner: the UE first obtains the UDM check value A based on the check indication information in the PDUSession_CreateSMContext Response message, and decodes the UDM check value A using the private key in the certificate to obtain a random number generated by the UDM; then, the UE generates a 22-byte array, the first 6 bytes of which are its own MAC address, and the last 16 bytes are the UDM random number. The MD5 digest algorithm is used to calculate the array to obtain a 16-byte (128-bit) hash value B, and the hash value is encrypted with the private key to obtain the check value B;

[0068] Step 18: SMF sends a Nudm_SDM_Get Request message to UDM, carrying the check value B and the UE's MAC;

[0069] Step 19: After receiving the Request message, the UDM also generates a 22-byte array. The first 6 bytes are the UE's MAC, and the last 16 bytes are the random number generated by the UDM. The digest algorithm MD5 is used on the array to obtain a 16-byte (128-bit) hash value A; the check value B is decrypted with the public key to obtain the hash value B. Hash value A and hash value B are compared. If they are equal, it is a legitimate terminal. If they are not equal, it is an illegal terminal. If they are equal, the UDM sends a Nudm_SDM_Get Response message to the SMF to indicate that the verification is successful; otherwise, access is denied.

[0070] Step 20: SMF sends a Session Modification Request to UPF, indicating that MAC learning is not required (btMACAR=0), and issues the routing forwarding rules for the terminal's legal MAC address;

[0071] Step 21: UPF sends Session Modification Response to SMF;

[0072] Step 22: SMF sends Nsmf_PDUSession_UpdateSMContext Response to UE;

[0073] Subsequently, only packets corresponding to valid MAC addresses are allowed to pass through, and packets corresponding to invalid MAC addresses are discarded.

[0074] This approach prevents illegal MAC addresses from accessing the network, reducing the risk of attacks on communication devices or user terminals, thereby improving the security of the communication network. Furthermore, by discarding illegal packets and forwarding only legitimate packets, the signaling overhead of the original process for user terminals to access the 5G network can be reduced, improving the utilization of network resources.

[0075] In addition to the above-mentioned MAC validity verification through the control plane message, the MAC validity verification can also be performed through the media plane message. Specifically, in the above-mentioned step S302, determining that the MAC address verification information corresponding to the verification indication information sent by the user terminal matches the verification indication information includes:

[0076] Obtaining a third check value corresponding to the data message sent by the user terminal, where the third check value is a check value obtained by encrypting the second random number using a public key;

[0077] receiving a fourth verification value sent by the user terminal, the fourth verification value being a verification value obtained by encrypting second communication information using a private key, wherein the second communication information includes a MAC address of the user terminal and the second random number;

[0078] In a case where it is determined that the third verification value and the fourth verification value satisfy the second verification condition, it is determined that the MAC address verification information matches the verification indication information.

[0079] Determining that the third verification value and the fourth verification value satisfy the second verification condition includes:

[0080] Determine a third hash value based on the MAC address of the user terminal and the second random number;

[0081] Decrypting the fourth check value using the public key to obtain a fourth hash value;

[0082] If the third hash value is equal to the fourth hash value, it is determined that the third verification value and the fourth verification value meet the second verification condition.

[0083] As shown in Figure 5, when a user terminal accesses a 5G network, the MAC address validity verification method may include the following steps:

[0084] Step 11: UE sends PDUSession_CreateSMContext Request to SMF;

[0085] Step 12: SMF sends Nudm_SDM_Get Request to UDM;

[0086] Step 13: UDM sends Nudm_SDM_Get Response to SMF, indicating that the MAC needs to be verified for validity. See Table 1 for field details.

[0087] Step 14: SMF sends PDUSession_CreateSMContext Response to UE;

[0088] Step 15: SMF sends PFCP Session Establishment Request to UPF;

[0089] Step 16: UPF sends PFCP Session Establishment Response to SMF;

[0090] Step 17: UE sends Nsmf_PDUSession_UpdateSMContext Request to SMF;

[0091] Step 18: SMF sends PFCP Session Modification Request to UPF;

[0092] Step 19: UPF sends PFCP Session Modification Response to SMF;

[0093] Step 20: SMF sends Nsmf_PDUSession_UpdateSMContext Response to UE;

[0094] Step 31: The UE sends a data message to the UPF;

[0095] Step 32: UPF sends PFCP Session Report Request (carrying MAC) to SMF;

[0096] Step 33: Based on the instructions in step 13, the SMF determines that a MAC validity check is required, and sends a Nudm_SDM_Get Request message to the UDM to request verification parameters.

[0097] Step 34: The UDM sends Nudm_SDM_Get Response to the SMF, carrying the check value A. Specifically, the check value A can be generated in the following way: the UDM first generates a 16-byte (128-bit) random number, encrypts the random number with the public key in the enterprise certificate, and uses the encrypted result as the check value A.

[0098] Step 35: The SMF sends a PFCP Session Report Response to the UPF, indicating that the MAC needs to be verified for validity and carries the verification value A.

[0099] Step 36: The UPF sends a data message to the UE, indicating that the MAC needs to be verified for validity and carrying the check value A;

[0100] Step 37: The UE sends a data message to the UPF, carrying a check value B. The generation of the check value B is as follows: the UE first needs to obtain the check value A in the previous message, and use the private key in the certificate to decode the check value A to obtain the random number generated by the UDM; then, the UE generates a 22-byte array, the first 6 bytes of which are its own MAC address, and the last 16 bytes are the random number of the UDM. The MD5 digest algorithm is used to calculate the array to obtain a 16-byte (128-bit) hash value B, and the hash value is encrypted with the private key to obtain the check value B;

[0101] Step 38: The UPF sends a PFCP Session Report Request to the SMF, carrying the MAC and check value B.

[0102] Step 39: SMF sends Nudm_SDM_Get Request to UDM, carrying MAC and check value B;

[0103] Step 40: After receiving the Request message, UDM also generates a 22-byte array. The first 6 bytes are the MAC of the UE, and the last 16 bytes are the random number generated by UDM. The digest algorithm MD5 is used on the array to obtain a 16-byte (128-bit) hash value A. The check value B is decrypted with the public key to obtain the hash value B. Hash value A and hash value B are compared. If they are equal, they are legal terminals. If they are not equal, they are illegal terminals. If they are equal, UDM sends a Nudm_SDM_Get Response message to SMF to indicate that the verification is passed. Otherwise, access is denied;

[0104] Step 41: SMF sends PFCP Session Report Response to UPF;

[0105] Step 42: The SMF sends a PFCP Session Modification Request to the UPF, carrying the forwarding rule for the verified MAC address.

[0106] Step 43: UPF sends PFCP Session Modification Response to SMF;

[0107] Subsequently, only packets corresponding to valid MAC addresses are allowed to pass through, and packets corresponding to invalid MAC addresses are discarded.

[0108] In a possible implementation, in step S301, sending verification instruction information to the user terminal includes:

[0109] Acquire a terminal identifier corresponding to the session establishment request message;

[0110] When it is determined that the user subscription information corresponding to the terminal identifier includes a MAC address, verification indication information is sent to the user terminal, where the verification indication information includes the MAC address.

[0111] As shown in Figure 6, when a user terminal accesses a 5G network, the MAC address validity verification method may include the following steps:

[0112] Step 11: UE sends PDUSession_CreateSMContext Request to SMF;

[0113] Step 12: SMF sends Nudm_SDM_Get Request to UDM;

[0114] Step 13: UDM sends Nudm_SDM_Get Response to SMF. If the MAC is specified in the user subscription information, the message indicates that the UE and MAC are bound and carries the bound MAC. The field details of the user subscription information are shown in Table 2:

[0115] Table 2

[0116] Step 14: PDUSession_CreateSMContext Response;

[0117] Step 15: SMF sends PFCP Session Establishment Request to UPF;

[0118] Step 16: UPF sends PFCP Session Establishment Response to SMF;

[0119] Step 17: UE sends Nsmf_PDUSession_UpdateSMContext Request to SMF;

[0120] Step 18: SMF sends a Session Modification Request to UPF, indicating that MAC learning is not required (btMACAR=0), and issues the routing forwarding rules for this MAC address;

[0121] Step 19: UPF sends Session Modification Response to SMF;

[0122] Step 20: SMF sends Nsmf_PDUSession_UpdateSMContext Response to UE;

[0123] Subsequently, only packets corresponding to this MAC address are allowed to pass through, and packets corresponding to illegal addresses other than this MAC address are discarded.

[0124] In a possible implementation, the embodiment of the present application further provides a method for verifying the legitimacy of a MAC address based on a target list. Specifically, after sending the verification indication information to the user terminal in step S301 above, the method may include the following steps:

[0125] In the case that it is determined that a legal MAC address matching the MAC address of the user terminal exists in the pre-stored target list, it is determined that the MAC address corresponding to the user terminal is a legal MAC address.

[0126] Furthermore, after determining that the MAC address of the user terminal is a valid MAC address, the method further includes:

[0127] Determine a routing forwarding rule corresponding to the MAC address according to the user terminal; and forward the data message sent by the user terminal according to the routing forwarding rule.

[0128] As shown in Figure 7, when a user terminal accesses a 5G network, the MAC address validity verification method may include the following steps:

[0129] Step 11: UE sends PDUSession_CreateSMContext Request to SMF;

[0130] Step 12: SMF sends Nudm_SDM_Get Request to UDM;

[0131] Step 13: UDM sends Nudm_SDM_Get Response to SMF, indicating that the MAC needs to be verified for validity. See Table 1 for field details.

[0132] Step 14: SMF sends PDUSession_CreateSMContext Response to UE;

[0133] Step 15: SMF sends PFCP Session Establishment Request to UPF;

[0134] Step 16: UPF sends PFCP Session Establishment Response to SMF;

[0135] Step 17: UE sends Nsmf_PDUSession_UpdateSMContext Request to SMF;

[0136] Step 18: SMF sends Session Modification Request to UPF;

[0137] Step 19: UPF sends Session Modification Response to SMF;

[0138] Step 20: SMF sends Nsmf_PDUSession_UpdateSMContext Response to UE;

[0139] Step 31: The UE sends a data message to the UPF;

[0140] Step 32: UPF sends PFCP Session Report Request (carrying MAC) to SMF;

[0141] Step 33: Based on the instructions in step 13, the SMF determines that a MAC validity check is required, and sends a Nudm_SDM_Get Request message to the UDM, carrying the MAC.

[0142] Step 34: UDM determines whether the MAC address is allowed to access based on the blacklist and whitelist. If it is allowed, it sends Nudm_SDM_Get Response to SMF to indicate normal access. Otherwise, it denies access.

[0143] Step 35: SMF sends PFCP Session Report Response to UPF;

[0144] Step 36: The SMF sends a PFCP Session Modification Request to the UPF, carrying the forwarding rule for the verified MAC address.

[0145] Step 37: UPF sends PFCP Session Modification Response to SMF;

[0146] Subsequently, only packets corresponding to valid MAC addresses are allowed to pass through, and packets corresponding to invalid MAC addresses are discarded.

[0147] The MAC address validity verification method provided in the embodiment of the present application receives a session establishment request message initiated by a user terminal and sends verification indication information to the user terminal. If a valid MAC address matching the MAC address of the user terminal is determined to exist in a pre-stored target list, the MAC address corresponding to the user terminal is determined to be a valid MAC address. In this way, the validity of the MAC address of the user terminal can be verified, preventing illegal MAC addresses from accessing the network, reducing the risk of network equipment or user terminals being attacked, and thus helping to improve the security of the communication network.

[0148] FIG8 shows a schematic diagram of the hardware structure of a communication device 800 provided in accordance with an embodiment of the present application. Referring to the figure, at the hardware level, the communication device 800 includes a processor, and optionally, an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage device. Of course, the communication device 800 may also include hardware required for other services.

[0149] The processor, network interface, and memory can be interconnected via an internal bus, such as an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. These buses can be classified as address buses, data buses, and control buses. For ease of illustration, the figure uses only one bidirectional arrow, but this does not imply that there is only one bus or only one type of bus.

[0150] The memory stores programs. Specifically, the programs may include program code, which includes computer operating instructions. The memory may include internal memory and non-volatile memory, and provides instructions and data to the processor.

[0151] The processor reads the corresponding computer program from the non-volatile memory into the internal memory and then runs it, forming a device for locating the target user at a logical level. The processor executes the program stored in the memory and specifically performs the method disclosed in the embodiment shown in Figure 3 and implements the functions and benefits of each method described in the method embodiments above, which will not be repeated here.

[0152] The method disclosed in the embodiment shown in FIG3 of the present application can be implemented in a processor or by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by hardware integrated logic circuits in the processor or software instructions. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The various methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above method.

[0153] The communication device 800 can also execute the methods described in the above method embodiments and realize the functions and beneficial effects of the methods described in the above method embodiments, which will not be described in detail here.

[0154] Of course, in addition to software implementation, the communication device of this application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0155] An embodiment of the present application also proposes a computer-readable storage medium, which stores one or more programs. When the one or more programs are executed by a communication device including multiple application programs, the communication device executes the method disclosed in the embodiment shown in Figure 3 and realizes the functions and beneficial effects of the various methods described in the previous method embodiments, which will not be repeated here.

[0156] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0157] Furthermore, an embodiment of the present application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the following process is implemented: the method disclosed in the embodiment shown in Figure 3 and the functions and beneficial effects of the various methods described in the previous method embodiments are implemented, which will not be repeated here.

[0158] In short, the above description is only a preferred embodiment of the present application and does not limit the scope of protection of the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

[0159] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0160] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0161] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0162] The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiments are generally similar to the method embodiments, so the description is relatively simple. For relevant parts, refer to the description of the method embodiments.

Claims

1. A method for verifying the legitimacy of a MAC address, the method comprising: Receiving a session establishment request message initiated by a user terminal, and sending verification indication information to the user terminal, wherein the verification indication information is used to instruct to perform a legitimacy check on the MAC address of the user terminal; In the case where it is determined that the MAC address verification information corresponding to the verification indication information sent by the user terminal matches the verification indication information, it is determined that the MAC address corresponding to the user terminal is a legal MAC address.

2. The method according to claim 1, wherein: The verification indication information includes a first verification value, which is a verification value obtained by encrypting the first random number using a public key; the MAC address verification information includes a second verification value, which is a verification value obtained by encrypting the first communication information using a private key; the first communication information includes the MAC address of the user terminal and the first random number; The determining that the MAC address verification information corresponding to the verification indication information and sent by the user terminal matches the verification indication information includes: In the case where it is determined that the first verification value and the second verification value satisfy a first verification condition, it is determined that the MAC address verification information matches the verification indication information.

3. The method according to claim 2, wherein: The determining that the first verification value and the second verification value satisfy a first verification condition includes: Determine a first hash value according to the MAC address of the user terminal and the first random number; Decrypting the second check value using the public key to obtain a second hash value; If the first hash value is equal to the second hash value, it is determined that the first verification value and the second verification value satisfy a first verification condition.

4. The method according to claim 1, wherein: The determining that the MAC address verification information corresponding to the verification indication information and sent by the user terminal matches the verification indication information includes: Acquire a third verification value corresponding to the data message sent by the user terminal, where the third verification value is a verification value obtained by encrypting the second random number using a public key; Receiving a fourth verification value sent by the user terminal, where the fourth verification value is a verification value obtained by encrypting the second communication information using a private key; the second communication information includes the MAC address of the user terminal and the second random number; When it is determined that the third verification value and the fourth verification value satisfy the second verification condition, it is determined that the MAC address verification information matches the verification indication information.

5. The method according to claim 4, wherein: The determining that the third verification value and the fourth verification value satisfy the second verification condition includes: Determine a third hash value according to the MAC address of the user terminal and the second random number; Decrypting the fourth check value using the public key to obtain a fourth hash value; If the third hash value is equal to the fourth hash value, it is determined that the third verification value and the fourth verification value satisfy a second verification condition.

6. The method according to claim 1, wherein: The sending verification indication information to the user terminal includes: Acquire a terminal identifier corresponding to the session establishment request message; When it is determined that the user subscription information corresponding to the terminal identifier includes a MAC address, verification indication information is sent to the user terminal, where the verification indication information includes the MAC address.

7. The method according to claim 1, wherein: After sending the verification indication information to the user terminal, the method further includes: In the case where it is determined that there is a legal MAC address matching the MAC address of the user terminal in the pre-stored target list, it is determined that the MAC address corresponding to the user terminal is a legal MAC address.

8. The method according to any one of claims 1 to 7, wherein: After determining that the MAC address of the user terminal is a legal MAC address, the method further includes: According to the MAC address of the user terminal, determine the routing corresponding to the MAC address Issue rules; According to the routing forwarding rule, the data message sent by the user terminal is forwarded.

9. A communication device, comprising a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the method according to any one of claims 1 to 8 are implemented.

10. A readable storage medium storing a program or an instruction, wherein the program or the instruction is executed by a processor to implement the steps of the method according to any one of claims 1 to 8.

Images